harden: make the background physically unable to read the shared state singleton (closes #324)

Five defects traced to one fact: src/background/index.js read and wrote the
module-level `state` singleton in src/shared/state.js, which the MV3 service
worker never populates and which answered an unpopulated read out of
DEFAULT_STATE in silence. Every previous fix added a loadState() before the
access, and that is what produced the fifth: a load detaches the objects an
in-flight handler is holding.

So the reachability goes rather than a sixth call site.

The background now has its own storage layer, src/background/state.js:
getState() is a detached, normalized per-call read, and updateState() is a
queued read-modify-write whose read is one storage round trip ahead of its
write. Nothing in the background holds an in-memory copy of the profile. The
write is the whole record, and updateState()'s header now names what that costs:
a popup write landing inside that one-round-trip window is reverted.

- Every handler takes one snapshot and answers from it, including the address
  it names: activeAddressOf(s) replaced a second, later storage read that
  could disagree with the first.
- wallet_switchEthereumChain applies applyChainSwitchFields() (split out of
  chainSwitch.js, which keeps the singleton path for the popup) inside
  updateState() instead of calling onChainSwitch() on the singleton.
- The remembered site decision is a read-modify-write, not a load-mutate-save
  around a prompt the user takes seconds to answer.
- backgroundRefresh() refreshes a private copy of the wallets and applies the
  balances that came back by address, so it never publishes an object other
  in-flight work holds, and a wallet added or deleted during the round trip
  survives its write.
- The transaction attempt takes its chain id and its endpoint from the same
  snapshot. They used to come from different moments, so a chain switch
  committed in between moved the endpoint under an artifact already verified
  against the old chain.

getProvider(rpcUrl, networkId) now REQUIRES the network id and validates it
against networks.js. That closes the cold-worker wrong-chain send at its shape
rather than at one call site: the hint used to default to currentNetwork() off
the unpopulated singleton, so the endpoint was the user's chain and ethers
fixed chainId at 0x1, and the wallet's own verifySignedTx then refused every
non-mainnet dApp send. refreshBalances(), lookupTokenInfo(), scanForAddresses()
and resolveEnsName() carry the id through; balances.js no longer requires
state.js at all.

The prohibition is enforced mechanically, not by review, and it is enforced by
the bundler rather than by a guess at what the bundler does. The table of
modules an entry point's bundle may not contain lives in
script/lib/forbiddenBundleInputs.js — one copy, read by both layers that act on
it — and build.js's assertNoForbiddenInputs() fails the build when esbuild's
metafile reports src/shared/state.js as an input of a background bundle, naming
the import chain from the metafile's own graph. That is the resolution the
shipped bundle was built from, so no specifier syntax, no hop and no resolution
rule can slip past it; Dockerfile:42 runs make build, so it holds in CI.

A background entry point the table does not name fails the build as well. The
five defects were accidents, and so is adding a second worker entry point
without knowing that a table elsewhere needs a line for it: entry points under
src/background/ are prohibited by default and must be listed, rather than
protected only when someone remembers. That prefix is the build's only notion of
"the background", and eslint.config.js scopes the lint rule from the same
constant so the two layers cannot disagree about it.

Every way the table can rot is a failure rather than a quiet pass: a key no
bundled entry point matched, a listed module this build bundled nowhere, and an
entry that lists no modules. The second is what makes a rename of
src/shared/state.js loud instead of silently disarming the check, and it is
stronger than an existsSync() because it also fails when the module is still
there but has dropped out of every bundle. The third is refused at require time,
where the table is defined, because an empty list also empties the lint rule's
forbidden set — one character, and a plain require of the singleton in the
worker was green in make test, make lint and make build alike.

An entry is recorded as checked only once its bundle's inputs are in hand. It
used to be recorded before the output lookup that produces them, so an early
return past that point left both halves of the guarantee satisfied by a bundle
nothing had examined.

What the assertion does NOT cover is a COPY of the singleton at another path: it
is keyed by path, so a copy builds and lints clean. That is stated where the
table lives, with what the residual actually is — a copy carries the singleton's
own guard, so an unloaded read is a loud StateNotLoadedError and defects 1-3
cannot recur silently, but a copy carries loadState() too, so defects 4 and 5
(a stale read several awaits after a load, a load detaching objects an in-flight
handler is mutating) would recur over it in silence.

make check does not run make build, so the assertion is unit tested against
synthetic metafiles in tests/buildForbiddenInputs.test.js: build.js runs its
build() only as a program now and exports the checks. Executing a check in CI
is not testing it — without that file, inverting the condition leaves every
check in this repo green with the singleton back in the worker. Each vacuous
pass above has a case, including the output lookup that finds nothing, the empty
list, the unlisted second entry point, and recordBundledInputs() itself, which
every other case used to hand-seed.

A custom ESLint rule walks the CommonJS require graph from every src/background/
file and reports the same thing in the editor, before a full bundle. It reads
the same table, and it matches specifiers textually, so it is best-effort fast
feedback and not the guarantee — two earlier revisions of it shipped holes (a
template literal, a dynamic import(), a comment inside the call, a directory
resolved through package.json main). Those are covered now and pinned by
tests/backgroundStateLintRule.test.js. Two shapes it does not report are pinned
there as asserted non-reports, so the header's list of its bounds is measured
rather than claimed: a computed specifier (require("../shared/" + "state"),
which esbuild constant-folds into the bundle) and a symlink to the module
(esbuild reports the real path). Each is make lint exit 0 and make build exit 2.

Reading a persisted field of the singleton before any load now throws
StateNotLoadedError instead of serving DEFAULT_STATE.

Test stubs: chrome.storage.local is a serialization boundary, and eight files
stubbed it with an aliasing get, so the object a module held and the object
"storage" held were one object — an assertion could pass on a build that never
wrote anything. Every test that drives real persistence now goes through
tests/support/storageStub.js, which structured-clones in both directions.

closes #320

build.js

@@ -4,6 +4,11 @@ const crypto = require("crypto");
 const { execSync } = require("child_process");
 const esbuild = require("esbuild");
 const { resolveVersion } = require("./script/lib/version");
+const {
+    BACKGROUND_ENTRY_PREFIX,
+    FORBIDDEN_INPUTS,
+    assertTableWellFormed,
+} = require("./script/lib/forbiddenBundleInputs");
 
 const DIST = path.join(__dirname, "dist");
 const DIST_CHROME = path.join(DIST, "chrome");
@@ -16,6 +21,18 @@ const SRC = path.join(__dirname, "src");
 // rotting with it.
 const AUDITED_MODULE = "src/shared/constants.js";
 
+// FORBIDDEN_INPUTS — what each entry point's bundle may not contain, and what
+// that covers — lives in script/lib/forbiddenBundleInputs.js, because the
+// ESLint rule reads the same table and two literal copies of a path drift.
+//
+// This is the authoritative check, and it is here rather than in the linter
+// because it consults the resolution esbuild actually performed. Any specifier
+// syntax, any hop, any resolution rule that puts the module in the bundle fails
+// the build, whether or not a text matcher would have recognized it. A
+// background entry point the table does not name fails as well, so a second
+// worker is protected by default rather than by someone remembering this file.
+// Dockerfile:42 runs `make build`, so it is enforced in CI.
+
 // The build receipt: every file this build emits, with its sha256 and whether
 // it is one of the audited bundles. script/verify-build is handed this and
 // checks dist/ against it, so the file list comes from the build that just ran
@@ -65,6 +82,164 @@ function outputsContainingAuditedModule(metafile) {
         .map(([outFile]) => repoRelative(outFile));
 }
 
+// Shortest import chain from `entryInput` to `target` through the metafile's
+// own input graph, or null when there is none. The message this feeds is the
+// point of the check: "state.js is in the worker bundle" is not actionable on
+// its own, "index.js -> chainSwitchFields.js -> state.js" is.
+function importChain(metafile, entryInput, target) {
+    const graph = new Map(
+        Object.entries(metafile.inputs).map(([input, info]) => [
+            repoRelative(input),
+            (info.imports || []).map((i) => repoRelative(i.path)),
+        ]),
+    );
+    const start = repoRelative(entryInput);
+    const seen = new Set([start]);
+    const queue = [[start]];
+    while (queue.length > 0) {
+        const chain = queue.shift();
+        for (const next of graph.get(chain[chain.length - 1]) || []) {
+            if (next === target) return chain.concat([next]);
+            if (seen.has(next)) continue;
+            seen.add(next);
+            queue.push(chain.concat([next]));
+        }
+    }
+    return null;
+}
+
+// What the forbidden-input checks accumulate over a whole build: which
+// FORBIDDEN_INPUTS keys were actually bundled, and every input of every output
+// this build emitted. Both are read by assertForbiddenTableCovered() at the
+// end — a table entry naming something that is not there any more enforces
+// nothing, and must fail rather than pass quietly.
+function newForbiddenRecord() {
+    return { entriesChecked: new Set(), bundledInputs: new Set() };
+}
+
+// Note every input of every output of one esbuild run. Deliberately not
+// restricted to the entry points named in FORBIDDEN_INPUTS: it is the POPUP
+// that legitimately bundles src/shared/state.js, and that is what makes
+// "the forbidden module still exists at this path" checkable at all.
+function recordBundledInputs(metafile, record) {
+    for (const info of Object.values(metafile.outputs)) {
+        for (const input of Object.keys(info.inputs)) {
+            record.bundledInputs.add(repoRelative(input));
+        }
+    }
+}
+
+// Fail the build when an entry point's bundle contains a module it is
+// prohibited from reaching. The inputs come from esbuild's metafile, so this is
+// the resolution the shipped bundle was built from and not a guess at it.
+//
+// A background entry point with no line in the table fails here too. The five
+// defects this exists to prevent were accidents, and so is adding a second
+// worker entry point without knowing that a table somewhere needs a line: the
+// protection has to be the default for that directory rather than something
+// the next author must opt into.
+function assertNoForbiddenInputs(
+    entryPoint,
+    outfile,
+    metafile,
+    record,
+    table = FORBIDDEN_INPUTS,
+) {
+    const entry = repoRelative(entryPoint);
+    const forbidden = table[entry];
+    if (!forbidden) {
+        if (!entry.startsWith(BACKGROUND_ENTRY_PREFIX)) return;
+        throw new Error(
+            `${entry} is a background entry point with no line in ` +
+                `FORBIDDEN_INPUTS, so nothing stops its bundle from ` +
+                `containing the shared state singleton. Add it to ` +
+                `script/lib/forbiddenBundleInputs.js. The MV3 worker never ` +
+                `populates that singleton, so reading it serves ` +
+                `DEFAULT_STATE; use getState()/updateState() from ` +
+                `src/background/state.js instead.`,
+        );
+    }
+
+    const out = repoRelative(outfile);
+    const entryOutput = Object.entries(metafile.outputs).find(
+        ([outFile]) => repoRelative(outFile) === out,
+    );
+    if (!entryOutput) {
+        throw new Error(`esbuild reported no metafile output for ${out}`);
+    }
+    const inputs = new Set(
+        Object.keys(entryOutput[1].inputs).map(repoRelative),
+    );
+
+    // Recorded only once the bundle's inputs are actually in hand. Marking the
+    // entry checked any earlier — as this did — means an early return above
+    // satisfies assertForbiddenTableCovered() with a bundle nobody examined,
+    // and the coverage half cannot tell that from a real check. The lookup
+    // above is the fragile step: repoRelative() resolves against process.cwd()
+    // while esbuild's output keys are cwd-relative, so a change to where the
+    // build runs from could miss.
+    record.entriesChecked.add(entry);
+
+    for (const module of forbidden) {
+        if (!inputs.has(module)) continue;
+        const chain = importChain(metafile, entryPoint, module);
+        throw new Error(
+            `${out} bundles ${module}, which ${entry} must not reach` +
+                `${chain ? `: ${chain.join(" -> ")}` : ""}. The MV3 worker ` +
+                `never populates the shared state singleton, so reading it ` +
+                `serves DEFAULT_STATE. Use getState()/updateState() from ` +
+                `src/background/state.js instead.`,
+        );
+    }
+}
+
+// Fail the build when the table has rotted away from the tree it describes.
+// Both halves of an entry rot independently, and either one turns the whole
+// prohibition into a pass that checks nothing:
+//
+//   - the KEY, when no bundled entry point matches it: the entry point was
+//     renamed or is no longer built, and no bundle was ever tested against the
+//     list;
+//   - the MODULE, when this build bundled it nowhere: the module was renamed,
+//     moved or deleted, so "is it an input of the background bundle" is asked
+//     about a path nothing resolves to and is answered no forever. The popup
+//     legitimately bundles src/shared/state.js, which is what makes this
+//     checkable — and it is stronger than an existsSync(), because it also
+//     fails when the file is still there but has dropped out of every bundle.
+//
+// This matters concretely: https://git.eeqj.de/sneak/AutistMask/issues/311
+// rewrites this persistence layer, and a rename that quietly disarmed the
+// guarantee would put the singleton back within reach of the worker with every
+// check in the repo still green.
+//
+// The third way — an entry that lists no modules at all — is refused where the
+// table is defined, at require time, because that one also empties the ESLint
+// rule's forbidden set and so has to fail before either layer runs. It is
+// re-checked here so the build's own half does not depend on the table having
+// been loaded from that file.
+function assertForbiddenTableCovered(record, table = FORBIDDEN_INPUTS) {
+    assertTableWellFormed(table);
+    for (const [entry, modules] of Object.entries(table)) {
+        if (!record.entriesChecked.has(entry)) {
+            throw new Error(
+                `${entry} is listed in FORBIDDEN_INPUTS but was not bundled, ` +
+                    `so nothing checked it`,
+            );
+        }
+        for (const module of modules) {
+            if (record.bundledInputs.has(module)) continue;
+            throw new Error(
+                `${module} is listed in FORBIDDEN_INPUTS for ${entry}, but ` +
+                    `this build bundled it nowhere, so the prohibition names ` +
+                    `a module that is not in this tree at that path and ` +
+                    `nothing enforces it. If the module moved, move it in ` +
+                    `script/lib/forbiddenBundleInputs.js too, which both ` +
+                    `this check and the ESLint rule read.`,
+            );
+        }
+    }
+}
+
 // Every file this build writes under dist/, recorded as it is written. This is
 // the build's own account of what it emitted; it is never recovered by
 // listing dist/, because a file that is in dist/ without this build having put
@@ -252,6 +427,9 @@ async function build() {
     // esbuild run below and recorded in the receipt for script/verify-build.
     const auditedBundles = [];
 
+    // What the forbidden-input checks accumulate across those same runs.
+    const forbiddenRecord = newForbiddenRecord();
+
     // compile tailwind CSS
     console.log("Compiling Tailwind CSS...");
     const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
@@ -293,6 +471,15 @@ async function build() {
             metafile: true,
             define,
         });
+        // Before the output is recorded as emitted: a bundle that violates a
+        // prohibition must abort the build, not be written into a receipt.
+        recordBundledInputs(result.metafile, forbiddenRecord);
+        assertNoForbiddenInputs(
+            entryPoint,
+            outfile,
+            result.metafile,
+            forbiddenRecord,
+        );
         recordEmitted(outfile);
         auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
     }
@@ -349,6 +536,8 @@ async function build() {
         path.join(DIST_FIREFOX, "manifest.json"),
     );
 
+    assertForbiddenTableCovered(forbiddenRecord);
+
     // Written last so a build that died partway through leaves no receipt at
     // all, which script/verify-build treats as a hard failure rather than as
     // "nothing to check".
@@ -359,7 +548,27 @@ async function build() {
     console.log("Build complete: dist/chrome/ and dist/firefox/");
 }
 
-build().catch((err) => {
-    console.error(`Build failed: ${err && err.message ? err.message : err}`);
-    process.exit(1);
-});
+// Run only as a program. Required as a module — which is how
+// tests/buildForbiddenInputs.test.js reaches the checks below — this file
+// builds nothing and writes nothing.
+if (require.main === module) {
+    build().catch((err) => {
+        console.error(
+            `Build failed: ${err && err.message ? err.message : err}`,
+        );
+        process.exit(1);
+    });
+}
+
+// Exported for tests/buildForbiddenInputs.test.js only. The prohibition these
+// three functions enforce is the guarantee behind
+// https://git.eeqj.de/sneak/AutistMask/issues/324, and `make check` does not
+// run `make build` — so they are unit tested against synthetic metafiles
+// rather than being exercised only by CI, where "it ran" is not "it works".
+module.exports = {
+    importChain,
+    newForbiddenRecord,
+    recordBundledInputs,
+    assertNoForbiddenInputs,
+    assertForbiddenTableCovered,
+};